Pin playnite 0.3.0 #2
Assignees
enricobuehler (Enrico Bühler)
Clear assignees
enricobuehler (Enrico Bühler)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unom/punktfunk-plugin-index#2
Reference in New Issue
Block a user
What changed
@punktfunk/plugin-playnite0.2.0->0.3.0Diff reviewed
Tarball compared:
That functional change is the point of the release: entries now say where a game is
installed, which is what lets the host recognise a title's process after Playnite's
launcher hands off and exits — the case where the host would otherwise lose the game
the moment the shim returns, and end the streaming session along with it.
Evidence for each checklist item
diff -ruof both extractedtarballs, reproduced above. 0.2.0 is the previously pinned version.
json-schema.org(draft-04/07/2020-12),w3.org(MathML/xlink/svg/xml namespaces),git.unom.io(the plugin's own homepage, repo, issues, and registry — metadata),github.com/Effect-TS/effect/issuesandreact.dev/errors/(library error-doclinks),
http://localhost(bundled-lib default base). No telemetry, analytics, orbeaconing. Unchanged from 0.2.0.
additional field off Playnite's own export payload. No new fs surface.
are readable:
dist/index.js718 lines / longest line 411 chars,dist/cli.js742 /304. The
dist/ui/chunks are a vite production build (declared:build:ui), as in0.2.0.
preinstall/install/postinstall/prepare/prepublish.prepublishOnlyis present and unchanged from 0.2.0 — it runsauthor-side on publish, never on a user's machine at install time.
dist.integrityfrom the registryand independently recomputed it from the downloaded tarball
(
openssl dgst -sha512 -binary new.tgz | base64). All three agree:sha512-XiWZLRqRGpcx6e3rHV/+7n3mWC9p6rs7a20oGxkzca/ty+4cVKq0I566byUJ+pWSa3TXRaQb4y4QhLNrHvhinQ==bun run validatealso passes.0.3.0.platforms: [windows]are unchanged and still correct.minHoststays0.15.0,checked rather than assumed: the new
detectkey is additive and optional host-side(
#[serde(default, skip_serializing_if = ...)], and the host setsdeny_unknown_fieldsnowhere), so 0.3.0 on a pre-detecthost behaves exactly like0.2.0 rather than failing to ingest. No newer host is required.
reviewedAt. Set to2026-07-27. It asserts that a human read this build — soit is only true once the reviewer has.
Dependencies added or changed
@punktfunk/plugin-kit^0.1.4->^0.2.0. First-party, same registry and org, andthe reason for the release: 0.2.0 of the kit carries the provider-entry
detectfieldthis plugin now emits. No new transitive weight — nothing else in
dependenciesmoved,and the bundle externalises
effectand@punktfunk/*rather than vendoring them.Anything that gave you pause
Two things, neither a blocker, both stated so they are not silently absorbed:
I wrote the release I am pinning. Hence the unticked boxes above. The security
value of this index comes from a second pair of eyes, and this PR does not have them
yet.
The pin covers the plugin tarball, not its dependency closure.
@punktfunk/plugin-kitis a caret range, so it resolves at install time and whatever
0.2.xis newest landson a user's host outside the hash pinned here. That is pre-existing — 0.2.0 pinned
^0.1.4the same way, and rom-manager does likewise — so it is not something this PRchanges or should fix unilaterally. Flagging it as a property of the model worth a
deliberate decision sometime, not as a finding against this release.
Nothing else stood out. The UI churn looked alarming by byte count until the prose diff
came back empty in both directions, which is what makes it a rebuild rather than a change.
0.3.0 teaches the provider to report where a game is installed. Each exported entry now carries `detect: { install_dir }` when Playnite knows one, which is what lets the host recognize a title's process after Playnite's launcher hands off and exits — the case where the host would otherwise lose the game the moment the shim returns, and end the session with it. The published delta is exactly that, and nothing else: * `installDir` added to the exported-game schema (nullable, defaults null), threaded into the entry as `detect.install_dir` when non-blank. * `@punktfunk/plugin-kit` ^0.1.4 -> ^0.2.0. * The version bump, embedded in both bundles. The console UI rebuilt because plugin-kit moved, but did not change: the diff against 0.2.0's chunk is minifier identifier churn (`Rt`->`kt`, `ar`->`lr`) with zero prose added or removed, so there is no new user-visible text and no new behaviour. Fonts and CSS are byte-identical. No new outbound hosts. Every absolute URL in the tarball is a schema/XML namespace, the plugin's own homepage and registry, or an effect/react error-doc link — no telemetry, no beaconing. No install lifecycle scripts (`prepublishOnly` is author-side and unchanged). No `eval`, `new Function`, or `child_process` in any bundle. minHost stays 0.15.0. The new `detect` key is additive and optional on the host side (`#[serde(default)]`, and the host denies no unknown fields), so 0.3.0 on a pre-`detect` host simply behaves like 0.2.0 rather than failing to ingest. Integrity was fetched from the registry and independently recomputed from the downloaded tarball; both agree.